Differentiated containerization and execution of web content based on trust level and other attributes

ABSTRACT

Systems and methods may provide for receiving web content and determining a trust level associated with the web content. Additionally, the web content may be mapped to an execution environment based at least in part on the trust level. In one example, the web content is stored to a trust level specific data container.

CROSS-REFERENCE TO RELATED APPLICATIONS

This patent arises from a continuation of U.S. patent application Ser.No. 13/830,634, filed on Mar. 14, 2013, entitled “ DIFFERENTIATEDCONTAINERIZATION AND EXECUTION OF WEB CONTENT BASED ON TRUST LEVEL ANDOTHER ATTRIBUTES ”, which is incorporated herein by reference in itsentirety.

BACKGROUND

Embodiments generally relate to access controls for web-basedapplications. More particularly, embodiments relate to differentiatedcontainerization and execution of web content based on trust level andother attributes.

Emerging markup languages such as HTML5 (Hypertext Markup Language 5,e.g., HTML5 Editor's Draft 8 May 2012, World Wide Web Consortium/W3C,www*w3*org). LLVM (e.g., LLVM 3.1, May 22, 2012, llvm.org), and otherruntime or just in time (JIT) environment languages may support morerobust multimedia related web platform development. The use of theselanguages by a web application developer, however, may also exposeclient device hardware that would otherwise be inaccessible bytraditional web content. While recently developed “sandboxing” solutionsmay provide some level of protection by preventing certain functionswhen code is sent as part of a web page, there remains considerable roomfor improvement. For example, conventional sandboxing solutions may notadequately distinguish between trustworthy sources of web content anduntrustworthy sources of web content. As a result, client devices may bevulnerable to attack by malware (malicious software) and other sourcesof web content.

BRIEF DESCRIPTION OF THE DRAWINGS

The various advantages of the embodiments of the present invention willbecome apparent to one skilled in the art by reading the followingspecification and appended claims, and by referencing the followingdrawings, in which:

FIG. 1 is a block diagram of an example of a containerizationarchitecture having a plurality of trust level specific data containersaccording to an embodiment;

FIG. 2 is a flowchart of an example of a method of using trust levels todifferentiate web content according to an embodiment;

FIG. 3 is a block diagram of an example of a containerizationarchitecture having a content offload module according to an embodiment;

FIG. 4 is a flowchart of an example of a method of using trust levelsand offload containers to differentiate web content according to anembodiment;

FIG. 5 is a block diagram of an example of a processor according to anembodiment; and

FIG. 6 is a block diagram of an example of a system according to anembodiment.

DETAILED DESCRIPTION

Turning now to FIG. 1, a containerization architecture 10 is shown inwhich web content 12 such as web applications, web code, services,“mash-ups”, etc., associated with a browser 14 is mapped to an executionenvironment based on trust level information corresponding to the webcontent 12. The term “containerization” may refer to the organization ofweb content information (e.g., objects) into one or more “containers”represented as a class, data structure, abstract data type (ADT),binaries, other executable codes, etc., whose instances may becollections of other objects. The containerization of the web content 12may follow specific access rules, wherein the illustrated architecture10 incorporates trust levels as part of those rules. In the illustratedexample, a browser interface 16 receives the web content 12 and acontainer designation module 18 determines a trust level associated withthe web content 12. In this regard, the web content 12 may incorporate aruntime or JIT environment language such as, for example, HTML5, LLVM,and so forth, that enables greater access to local platform hardware 24and/or memory 26 than traditional web content. Accordingly, the use oftrust levels to containerize the web content 12 and map the web content12 to an execution environment may provide significantly improvedruntime protection, as will be discussed in greater detail.

The container designation module 18 may access a trust level database20, which is populated with data from other devices 22 (e.g., machinesand/or users), wherein the information in the trust level database 20may in turn be used to determine the trust level. For example, the trustlevel database 20 might include information regarding “whitelist” sites,“greylist” sites, “blacklist” sites, etc., as well as other origin datasuch as, for example, provider information, application developerinformation, mash-up origin and/or behavior information, etc. Thecontainer designation module 18 may also use a real-time trustassessment 26 to determine the trust level of the web content 12,wherein the real-time trust assessment 26 may be generated internally bythe containerization architecture 10 (e.g., as part of a security toolplug-in) or obtained from another security module 28 (e.g., third partysecurity software). More particularly, c.

The illustrated architecture 10 also includes a plurality of trust levelspecific data containers 30 (30 a-30 d) to organize and/or store the webcontent 12 according to one or more trust levels corresponding to theweb content 12. For example, a high trust container 30 a may be used tostore content associated with whitelist sites, wherein content in thehigh (e.g., “native”) trust container 30 a may be considered verytrustworthy and treated similarly as native code from the perspective ofthe execution environment. A medium trust container 30 h, on the otherhand, may be used to store content associated with greylist sites,wherein content in the medium (e.g., “browser application”) trustcontainer 30 b may be considered moderately trustworthy and treatedsimilarly as browser applications from the perspective of the executionenvironment. Additionally, a low trust container 30 c may be used tostore content associated with unknown sites, wherein content in the low(e.g., “testing”) trust container 30 c may be considered potentiallyuntrustworthy and treated similarly as content from new web sites. Theillustrated architecture 10 also includes a trash container 30 d thatmay be used to store content associated with blacklist sites, whereincontent in the trash container 30 d may be blocked from execution and/ordeleted.

An environment module 32 may map the web content 12 to an executionenvironment based at least in part on the trust level associated withthe web content 12. Thus, the environment module 32 may use a workscheduler 34 to allocate resources in the platform hardware 24 such asprocessors (e.g., central processing unit/CPU, graphics processingunit/GPU), input output (I/O) controllers (e.g., display, audio, video,network), etc., for execution of one or more workloads associated withthe web content 12. Similarly, the environment module 32 may use amemory map module 36 (e.g., input output memory management unit/IOMMU)to conduct one or more memory transactions associated with the webcontent 12. Of particular note is that the scheduling of workloads,allocation of resources, and conduct of memory transactions may all be afunction of the trust level associated with the web content 12,

More particularly, the type of container 30 holding the underlying webcontent 12 may determine how the workload scheduler 34 allocatesresources and schedules workloads, as well as how the memory map module36 executes memory transactions with respect to the memory 26. Forexample, all platform resources may be available to workloads associatedwith content in the high trust container 30 a, whereas only a subset ofthe platform resources might be available to workloads associated withcontent in the medium trust container 30 b. Workloads associated withcontent in the low trust container 30 c, on the other hand, may haveonly limited access to platform resources and workloads associated withcontent in the trash container 30 d may be prevented from any access tothe platform hardware whatsoever. Additionally, certain restricted areasof the memory 26 may be prevented from access by web content in thetrash container 30 d, the low trust container 30 c and/or the mediumtrust container 30 b. As will be discussed in greater detail, othercontext attributes such as, fbr example, stack composition (e.g., codelogic, data presentation, data consumption), latency of one or more webtransactions, content objective (e.g., correlation between type of website and data consumed), service/site type, etc., associated with theweb content 12, may also be used to containerize the web content 12 andselect an execution environment for the web content 12.

Turning now to FIG. 2, a method 40 of using trust levels todifferentiate web content is shown. The method 40 may be implemented asa set of logic instructions and/or firmware stored in a machine- orcomputer-readable medium such as random access memory (RAM), read onlymemory (ROM), programmable ROM (PROM), flash memory, etc., inconfigurable logic such as, for example, programmable logic arrays(PLAs), field programmable gate arrays (FPGAs), complex programmablelogic devices (CPLDs), in fixed-functionality logic hardware usingcircuit technology such as, for example, application specific integratedcircuit (ASIC), complementary metal oxide semiconductor (CMOS) ortransistor-transistor logic (TTL) technology, or any combinationthereof. For example, computer program code to carry out operationsshown in the method 40 may be written in any combination of one or moreprogramming languages, including an object oriented programming languagesuch as C++ or the like and conventional procedural programminglanguages, such as the “C” programming language or similar programminglanguages. Moreover, the method 40 may be implemented as thecontainerization architecture 10 (FIG. 1) using any of theaforementioned circuit technologies.

Illustrated processing block 42 provides for receiving web content suchas, for example, web applications, web code, services, etc., wherein atleast a portion of the web content may incorporate a runtime or JITenvironment language such as, for example, HTML5, LLVM, and so forth.Block 44 may determine a trust level associated with the web content. Asalready noted, the determination at block 44 may take into considerationinformation in a trust level database, one or more real-time trust levelassessments, etc., or any combination thereof. Illustrated block 46 mapsthe web content to an execution environment based on the trust level,wherein using the trust level to select an execution environment for theweb content may provide significantly improved runtime protection.

FIG. 3 shows a containerization architecture 50 in which the web content12 (12 a, 12 b) may be split between a local execution environment andan “offload” execution environment. In the illustrated example, thebrowser interface 16 receives the web content 12 and a containerdesignation module 52 determines a trust level associated with the webcontent 12 based on, for example, information from the trust leveldatabase 20 and/or one or more real-time trust assessments 26, Asalready noted, the real-time trust assessments 26 may be obtained from asecurity module 28 such as a built-in assessment tool, a separatesecurity tool, an enterprise information technology module, a cloudmodule, or any combination thereof. The architecture 50 may also includea content offload module 54 that selectively sends a portion 12 a of theweb content 12 to an offload container 56, wherein the offload container56 may be associated with a provider of the web content 12, an emulationmodule of the local computing device/platform, enterprise data center, aprivate cloud, a third party service provider, and so forth, in order tomap the portion 12 a of the web content 12 to another, more risktolerant execution environment.

More particularly, the container designation module 52 may detectsituations in which the trust level is relatively low (e.g., trust levelis below a threshold) and execution latency is tolerated (e.g., alatency tolerance condition is satisfied), wherein in such situations,the portion 12 a of the web content 12 directed to the offload container56 may represent unverified, latency insensitive web content. In such acase, a result associated with the offload container 56 may be receivedfrom the entity and/or processor corresponding to the offload container56. If, on the other hand, the illustrated container designation module52 determines that either the trust level is relatively high orexecution latency is not tolerated, the content may be processed locallyas the trusted, latency sensitive portion 12 b of the web content 12.The environment module 32 may use the workload scheduler 34 and/ormemory map module 36 to map the portion 12 b of the web content 12 to anexecution environment based on the trust level of the portion 12 h, asalready discussed.

FIG. 4 shows a method 60 of using trust levels and offload containers todifferentiate web content. The method 40 may be implemented as a set oflogic instructions and/or firmware stored in a machine- orcomputer-readable medium such as RAM, ROM, PROM, flash memory, etc., inconfigurable logic such as, for example, PLAs, FPGAs, CPLDs, infixed-functionality logic hardware using circuit technology such as, forexample, ASIC, CMOS or TTL technology, or any combination thereof.Illustrated processing block 62 provides for receiving web content,wherein a trust level and latency may be determined for the web contentat block 64. Determining the latency might involve identifying how muchexecution latency will result from offloading at least a portion of theweb content to another execution environment, which may reside on adifferent platform, system and/or network (e.g., web content provider,local emulation module, enterprise data center, private cloud, thirdparty service provider, etc.), For example, it might be estimated atblock 64 that a particular unit of work associated with the web contentis most likely to take x milliseconds to process on a third partyservice provider.

Block 66 may determine whether the trust level is below a particularthreshold. If so, illustrated block 68 determines whether a latencytolerance condition is satisfied. The latency tolerance condition maytake into consideration historical information, quality of service (QoS)information, service level agreement (SLA) information, and so forth,wherein the determination at block 68 may involve conducting acomparison between, for example, the latency determined at block 64 anda maximum execution latency. If the latency tolerance condition issatisfied (e.g., latency is below the maximum execution latency),illustrated block 70 maps the corresponding portion of the web contentto an offload container. If, on the other hand, either the trust levelis not below the particular threshold or the latency tolerance conditionis not satisfied, block 72 may map the corresponding portion of the webcontent to a local execution environment. Block 72 may take the trustlevel into consideration when deciding which platform resources toexpose to the web content.

As already noted, other context attributes such as, for example, stackcomposition, content objective, service type, and so forth, may also beused to determine a trust level for the web content. For example, if thecode logic as reflected in the stack composition of the web contentindicates that the web content involves one type of activity (e.g.,login cookie retrieval), but the data presented to the user involvesanother type of activity (e.g., social networking, instantmessaging/IM), it might be inferred that the trust level of the webcontent is relatively low. Other trust level inferences may also bemade, even if the origin of the web content is not documented in thetrust level database.

FIG. 5 illustrates a processor core 200 according to one embodiment. Theprocessor core 200 may be the core for any type of processor, such as amicro-processor, an embedded processor, a digital signal processor(DSP), a network processor, or other device to execute code, Althoughonly one processor core 200 is illustrated in FIG. 5, a processingelement may alternatively include more than one of the processor core200 illustrated in FIG. 5. The processor core 200 may be asingle-threaded core or, for at least one embodiment, the processor core200 may be multithreaded in that it may include more than one hardwarethread context (or “logical processor”) per core.

FIG. 5 also illustrates a memory 270 coupled to the processor 200, Thememory 270 may be any of a wide variety of memories (including variouslayers of memory hierarchy) as are known or otherwise available to thoseof skill in the art, The memory 270 may include one or more code 213instruction(s) to be executed by the processor 200 core, wherein thecode 213 may implement the containerization architecture 10 (FIG. 1)and/or the containerization architecture 50 (FIG. 3), already discussed.The processor core 200 follows a program sequence of instructionsindicated by the code 213. Each instruction may enter a front endportion 210 and be processed by one or more decoders 220. The decoder220 may generate as its output a micro operation such as a fixed widthmicro operation in a predefined format, or may generate otherinstructions, microinstructions, or control signals which reflect theoriginal code instruction. The illustrated front end 210 also includesregister renaming logic 225 and scheduling logic 230, which generallyallocate resources and queue the operation corresponding to the convertinstruction for execution.

The processor 200 is shown including execution logic 250 having a set ofexecution units 255-1 through 255-N. Some embodiments may include anumber of execution units dedicated to specific functions or sets offunctions. Other embodiments may include only one execution unit or oneexecution unit that can perform a particular function. The illustratedexecution logic 250 performs the operations specified by codeinstructions.

After completion of execution of the operations specified by the codeinstructions, back end logic 260 retires the instructions of the code213. In one embodiment, the processor 200 allows out of order executionbut requires in order retirement of instructions. Retirement logic 265may take a variety of forms as known to those of skill in the art (e.g.,re-order buffers or the like). In this manner, the processor core 200 istransformed during execution of the code 213, at least in terms of theoutput generated by the decoder, the hardware registers and tablesutilized by the register renaming logic 225, and any registers (notshown) modified by the execution logic 250.

Although not illustrated in FIG. 5, a processing element may includeother elements on chip with the processor core 200. For example, aprocessing element may include memory control logic along with theprocessor core 200. The processing element may include I/O control logicand/or may include I/O control logic integrated with memory controllogic. The processing element may also include one or more caches.

Referring now to FIG. 6, shown is a block diagram of a system 1000embodiment in accordance with an embodiment of the present invention.Shown in FIG. 6 is a multiprocessor system 1000 that includes a firstprocessing element 1070 and a second processing element 1080. While twoprocessing elements 1070 and 1080 are shown, it is to be understood thatan embodiment of the system 1000 may also include only one suchprocessing element.

The system 1000 is illustrated as a point-to-point interconnect system,wherein the first processing element 1070 and the second processingelement 1080 are coupled via a point-to-point interconnect 1050. Itshould be understood that any or all of the interconnects illustrated inFIG. 6 may be implemented as a multi-drop bus rather than point-to-pointinterconnect.

As shown in FIG. 6, each of processing elements 1070 and 1080 may bemulticore processors, including first and second processor cores (i.e.,processor cores 1074 a and 1074 h and processor cores 1084 a and 1084b). Such cores 1074, 1074 b, 1084 a, 1084 b may be configured to executeinstruction code in a manner similar to that discussed above in.connection. with FIG. 5.

Each processing element 1070, 1080 may include at least one shared cache1896. The shared cache 1896 a, 1896 b may store data (e.g.,instructions) that are utilized by one or more components of theprocessor, such as the cores 1074 a, 1074 b and 1084 a, 1084 b,respectively. For example, the shared cache may locally cache datastored in a memory 1032, 1034 for faster access by components of theprocessor. In one or more embodiments, the shared cache may include oneor more mid-level caches, such as level 2 (L2), level 3 (L3), level 4(L4), or other levels of cache, a last level cache (LLC), and/orcombinations thereof.

While shown. with only two processing elements 1070, 1080, it is to beunderstood that the scope of the present invention is not so limited. Inother embodiments, one or more additional processing elements may bepresent in a given processor. Alternatively, one or more of processingelements 1070, 1080 may be an element other than a processor, such as anaccelerator or a field programmable gate array. For example, additionalprocessing element(s) may include additional processors(s) that are thesame as a first processor 1070, additional processor(s) that areheterogeneous or asymmetric to processor a first processor 1070,accelerators (such as, e.g., graphics accelerators or digital signalprocessing (DSP) units), field programmable gate arrays, or any otherprocessing element. There can be a variety of differences between theprocessing elements 1070, 1080 in terms of a spectrum of metrics ofmerit including architectural, micro architectural, thermal, powerconsumption characteristics, and the like. These differences mayeffectively manifest themselves as asymmetry and heterogeneity amongstthe processing elements 1070, 1080. For at least one embodiment, thevarious processing elements 1070, 1080 may reside in the same diepackage.

The first processing element 1070 may further include memory controllerlogic (MC) 1072 and point-to-point (P-P) interfaces 1076 and 1078.Similarly, the second processing element 1080 may include a MC 1082 andP-P interfaces 1086 and 1088. As shown in FIG. 6, MC's 1072 and 1082couple the processors to respective memories, namely a memory 1032 and amemory 1034, which may be portions of main memory locally attached tothe respective processors. While the MC logic 1072 and 1082 isillustrated as integrated into the processing elements 1070, 1080, foralternative embodiments the MC logic may be discrete logic outside theprocessing elements 1070, 1080 rather than integrated therein.

The first processing element 1070 and the second processing element 1080may be coupled to an I/O subsystem 1090 via P-P interconnects 1076 1086,respectively. As shown in FIG. 6, the I/O subsystem 1090 includes P-Pinterfaces 1094 and 1098. Furthermore, I/O subsystem 1090 includes aninterface 1092 to couple I/O subsystem 1090 with a high performancegraphics engine 1038. In one embodiment, bus 1049 may be used to couplegraphics engine 1038 to I/O subsystem 1090. Alternately, apoint-to-point interconnect may couple these components.

In turn, I/O subsystem 1090 may be coupled to a first bus 1016 via aninterface 1096. In one embodiment, the first bus 1016 may be aPeripheral Component Interconnect (PCI) bus, or a bus such as a PCIExpress bus or another third generation I/O interconnect bus, althoughthe scope of the present invention is not so limited.

As shown in FIG. 6, various I/O devices 1014 may be coupled to the firstbus 1016, along with a bus bridge 1018 which may couple the first bus1016 to a second bus 1020. In one embodiment, the second bus 1020 may bea low pin count (ITC) bus. Various devices may be coupled to the secondbus 1020 including, for example, a keyboard/mouse 1012, networkcontrollers/communication device(s) 1026 (which may in turn be incommunication with a computer network), and a data storage unit 1019such as a disk drive or other mass storage device which may include code1030, in one embodiment. In one example, web content is received via thecommunication devices 1026. The code 1030 may include instructions forperforming embodiments of one or more of the methods described above.Thus, the illustrated code 1030 may implement the containerizationarchitecture 10 (FIG. 1) andior the containerization architecture 50,and may be similar to the code 213 (FIG. 5), already discussed. Further,an audio I/O 1024 may be coupled to second bus 1020.

Note that other embodiments are contemplated. For example, instead ofthe point-to-point architecture of FIG. 6, a system may implement amulti-drop bus or another such communication topology. Also, theelements of FIG. 6 may alternatively be partitioned using more or fewerintegrated chips than shown in FIG. 6.

Additional Notes and Examples:

Example one may therefore include a method of differentiating webcontent in which web content is received and a trust level associatedwith the web content is determined. The method may also provide formapping the web content to an execution environment based at least inpart on the trust level.

Additionally, the method of example one may further include storing theweb content to a trust level specific data container.

Additionally, the web content of the example one method may be mapped tothe execution environment further based on a context attribute includingone or more of a stack composition associated with the web content, alatency of one or more web transactions associated with the web content,an objective of the web content and a service type associated with theweb content.

Moreover, mapping the web content to the execution environment in themethod of example one may further include sending at least a portion ofthe web content to an offload container associated with one or more of aprovider of the web content, an emulation module of a local computingdevice, an enterprise data center, a private cloud and a third partyservice provider, and receiving a result associated with the offloadcontainer.

In addition, at least a portion of the web content in the method ofexample one may be sent to the offload container if the trust level isbelow a threshold and a latency tolerance condition is satisfied,

In addition method of example one may further include accessing a trustlevel database, wherein the trust level is determined based at least inpart on the trust level database.

Moreover, the method of example one may further include obtaining areal-time trust level assessment, wherein the trust level is determinedbased at least in part on the real-time trust level assessment.

Additionally, obtaining the real-time trust level assessmentn theexample one method may include generating the real-time trust levelassessment.

Additionally, mapping the web content to the execution environment inthe example one method may include scheduling one or more workloadsassociated with the web content based at least in part on the trustlevel, provisioning one or more resources for the one or more workloads,and conducting one or more memory transactions associated with the webcontent based at least in part on the trust level.

Example two may include at least one computer readable storage mediumcomprising a set of instructions which, if executed by a processor,cause a computing device to perform the method of example one.

Example three may include a web content differentiation apparatus havinga browser interface to receive web content and a container designationmodule to determine a trust level associated with the web content. Theapparatus may also have an environment module to map the web content toan execution environment based at least in part on the trust level.

Additionally, the apparatus of example three may further include aplurality of trust level specific data containers, wherein the containerdesignation module is to store the web content to one or more of theplurality of trust level specific data containers.

Additionally, the web content of the example three apparatus may bemapped to the execution environment further based on a context attributeincluding one or more of a stack composition associated with the webcontent, a latency of one or more web transactions associated with theweb content, an objective of the web content and a service typeassociated with the web content.

Moreover, the apparatus of example three may further including a contentoffload module to send at least a portion of the web content to anoffload container associated with one or more of a provider of the webcontent, an emulation module of a local computing device, an enterprisedata center, a private cloud and a third party service provider to mapthe web content to the execution environment, and to receive a resultassociated with the offload container.

In addition, at least a portion of the web container in the examplethree method may be sent to the offload container if the trust level isbelow a threshold and a latency tolerance condition is satisfied.

In addition, the apparatus of example three may further include a trustlevel database, wherein the trust level is to be determined based atleast in part on the trust level database.

Moreover, the container designation module in the example threeapparatus may obtain a real-time trust level assessment, wherein thetrust level is to be determined based at least in part on the real-timetrust level assessment.

Additionally, the apparatus of example three may further include asecurity module to generate the real-time trust level assessment.

Additionally, the security module of example three may be one or more ofa built-in assessment tool, a separate security tool, an enterpriseinformation technology module and a cloud module.

Moreover, the apparatus of example three may further include a workloadscheduler to schedule one or more workloads associated with the webcontent based at least in part on the trust level and to provision oneor more resources for the one or more workloads, wherein the environmentmodule is to conduct one or more memory transactions associated with theweb content based at least in part on the trust level.

Techniques described herein may therefore enable differentiatedcontainerization that provides different client execution environments(e.g., memory, CPU, graphics, network, operating system/OS) for webcontent based on the trust level of the originator of the web content.Moreover, improved runtime protection of client devices from maiware(malicious software and other web content from unknown sources. Othercontext attributes such as stack composition (code logic, datapresented, data consumed), latency of web transactions, purpose of thecontent, service type, and so forth, may also be used to differentiateweb content and configure execution environments. In addition, webcontent may be split between the client device, cloud computingresources (e.g., content provider, enterprise data center, privatecloud, third party service provider), based on trust level, latency,etc. The containerization modules may be implemented as an independentsecurity application, an add-on to security tool (e.g., Secure Enclave,McAfee® DeepSafe), in firmware, etc., or any combination thereof.Techniques may also provide for correlating real-time assessment datafrom other security applications and/or resources.

Various embodiments may be implemented using hardware elements, softwareelements, or a combination of both. Examples of hardware elements mayinclude processors, microprocessors, circuits, circuit elements (e.g.,transistors, resistors, capacitors, inductors, and so forth), integratedcircuits, application specific integrated circuits (ASIC), programmablelogic devices (PLD), digital signal processors (DSP), field programmablegate array (FPGA), logic gates, registers, semiconductor device, chips,microchips, chip sets, and so forth. Examples of software may includesoftware components, programs, applications, computer programs,application programs, system programs, machine programs, operatingsystem software, middleware, firmware, software modules, routines,subroutines, functions, methods, procedures, software interfaces,application program interfaces (API), instruction sets, computing code,computer code, code segments, computer code segments, words, values,symbols, or any combination thereof. Determining whether an embodimentis implemented using hardware elements and/or software elements may varyin accordance with any number of factors, such as desired computationalrate, power levels, heat tolerances, processing cycle budget, input datarates, output data rates, memory resources, data bus speeds and otherdesign or performance constraints.

One or more aspects of at least one embodiment may be implemented byrepresentative instructions stored on a machine-readable medium whichrepresents various logic within the processor, which when read by amachine causes the machine to fabricate logic to perform the techniquesdescribed herein. Such representations, known as “IP cores” may bestored on a tangible, machine readable medium and supplied to variouscustomers or manufacturing facilities to load into the fabricationmachines that actually make the logic or processor.

Embodiments of the present invention are applicable for use with alltypes of semiconductor integrated circuit (“IC”) chips. Examples ofthese IC chips include but are not limited to processors, controllers,chipset components, programmable logic arrays (PLAs), memory chips,network chips, and the like. In addition, in some of the drawings,signal conductor lines are represented with lines. Some may bedifferent, to indicate more constituent signal paths, have a numberlabel, to indicate a number of constituent signal paths, and/or havearrows at one or more ends, to indicate primary information flowdirection. This, however, should not be construed in a limiting manner.Rather, such added detail may be used in connection with one or moreexemplary embodiments to facilitate easier understanding of a circuit.Any represented signal lines, whether or not having additionalinformation, may actually comprise one or more signals that may travelin multiple directions and may be implemented with any suitable type ofsignal scheme, e.g., digital or analog lines implemented withdifferential pairs, optical fiber lines, and/or single-ended lines.

Example sizes/models/values/ranges may have been given, althoughembodiments of the present invention are not limited to the same. Asmanufacturing techniques (e.g., photolithography) mature over time, itis expected that devices of smaller size may be manufactured. Inaddition, well known power/ground connections to IC chips and othercomponents may or may not be shown within the figures, for simplicity ofillustration and discussion, and so as not to obscure certain aspects ofthe embodiments of the invention. Further, arrangements may be shown inblock diagram form in order to avoid obscuring embodiments of theinvention, and also in view of the fact that specifics with respect toimplementation of such block diagram arrangements are highly dependentupon the platform within which the embodiment is to be implemented,i.e., such specifics should be well within purview of one skilled in theart. Where specific details (e.g., circuits) are set forth in order todescribe example embodiments of the invention, it should be apparent toone skilled in the art that embodiments of the invention can bepracticed without, or with variation of, these specific details. Thedescription is thus to be regarded as illustrative instead of limiting.

Some embodiments may be implemented, for example, using a machine ortangible computer-readable medium or article which may store aninstruction or a set of instructions that, if executed by a machine, maycause the machine to perform a method and/or operations in accordancewith the embodiments. Such a machine may include, for example, anysuitable processing platform, computing platform, computing device,processing device, computing system, processing system, computer,processor, or the like, and may be implemented using any suitablecombination of hardware and/or software. The machine-readable medium orarticle may include, for example, any suitable type of memory unit,memory device, memory article, memory medium, storage device, storagearticle, storage medium and/or storage unit, for example, memory,removable or non-removable media, erasable or non-erasable media,writeable or re-writeable media, digital or analog media, hard disk,floppy disk, Compact Disk Read Only Memory (CD-ROM), Compact DiskRecordable (CD-R), Compact Disk Rewriteable (CD-RW), optical disk,magnetic media, magneto-optical media, removable memory cards or disks,various types of Digital Versatile Disk (DVD), a tape, a cassette, orthe like. The instructions may include any suitable type of code, suchas source code, compiled code, interpreted code, executable code, staticcode, dynamic code, encrypted code, and the like, implemented using anysuitable high-level, low-level, object-oriented, visual, compiled and/orinterpreted programming language.

Unless specifically stated otherwise, it may be appreciated that termssuch as “processing,” “computing,” “calculating,” “determining,” or thelike, refer to the action and/or processes of a computer or computingsystem, or similar electronic computing device, that manipulates and/ortransforms data represented as physical quantities (e.g., electronic)within the computing system's registers and/or memories into other datasimilarly represented as physical quantities within the computingsystem's memories, registers or other such information storage,transmission or display devices. The embodiments are not limited in thiscontext.

The term “coupled” may be used herein to refer to any type ofrelationship, direct or indirect, between the components in question,and may apply to electrical, mechanical, fluid, optical,electromagnetic, electromechanical or other connections. In addition,the terms “first”, “second”, etc. may be used herein only to facilitatediscussion, and carry no particular temporal or chronologicalsignificance unless otherwise indicated.

Those skilled in the art will appreciate from the foregoing descriptionthat the broad techniques of the embodiments of the present inventioncan be implemented in a variety of forms. Therefore, while theembodiments of this invention have been described in connection withparticular examples thereof, the true scope of the embodiments of theinvention should not be so limited since other modifications will becomeapparent to the skilled practitioner upon a study of the drawings,specification, and following claims.

We claim:
 1. An apparatus to differentiate web content, comprising: abrowser interface to receive web content; a container designation moduleto determine a trust level associated with the web content; and anenvironment module to map the web content to an execution environmentbased at least in part on the trust level.